Khaled Alenazi

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installations. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The WPL I/O service endpoint is registered on the public WordPress init hook with no WordPress capability check, and the required api key and api secret values are static defaults seeded by the plugin's own SQL migration files, meaning any unauthenticated attacker who knows these publicly documented defaults can reach and exploit the vulnerable upload path.

**Name of the Vulnerable Software and Affected Versions** MainWP Child WordPress plugin versions prior to 6.1.2 **Description** The site-registration request handler fails to verify the identity of the requester when password authentication is disabled for the targeted account. This allows an unauthenticated attacker to obtain a valid authentication session for that account, including those with administrator privileges, by specifying the login name in a single registration request. **Recommendations** Update the MainWP Child WordPress plugin to version 6.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** AI Copilot WordPress plugin versions prior to 1.5.4 **Description** The plugin fails to bind OAuth access tokens to a specific WordPress user. Consequently, the system accepts any valid token as an administrator session. This allows unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools with administrator privileges, enabling actions such as arbitrary user creation and role escalation. **Recommendations** Update the AI Copilot WordPress plugin to version 1.5.4 or later.

**Name of the Vulnerable Software and Affected Versions** User Registration & Membership WordPress plugin versions prior to 5.2.3 **Description** An issue exists where the plugin fails to validate if the membership tier submitted during public registration is among the tiers permitted by the registration form. This allows unauthenticated users to register for any published membership tier and acquire the associated user role, which could potentially grant administrator privileges if such a tier is available. **Recommendations** Update the User Registration & Membership WordPress plugin to version 5.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** Shibboleth WordPress plugin versions prior to 2.5.4 **Description** An authentication bypass exists when the HTTP header identity mode is enabled without an anti-spoofing key. In this configuration, the plugin treats any request containing identity headers as an authenticated session without proper verification. If untrusted client headers reach the application, an unauthenticated attacker can log in using forged identity headers. Furthermore, if automatic account creation and default administrator role mapping are enabled, the attacker can create and sign in as a new administrator. This issue occurs when the non-default HTTP header attribute mode is active, the spoof key is empty or absent, and the deployment fails to strip untrusted client headers before they reach the application. **Recommendations** Update Shibboleth WordPress plugin to version 2.5.4 or later. As a temporary mitigation, ensure that untrusted client headers are stripped before they reach the application or configure a valid anti-spoofing key.

**Name of the Vulnerable Software and Affected Versions** miniOrange OTP Login, Verification and SMS Notifications versions prior to 5.5.2 **Description** An authentication bypass exists that allows for administrator account takeover. The issue occurs because the `um reset password process hook()` function fails to perform server-side verification to ensure the OTP validation step was completed. Instead, it relies on a public `form nonce` nonce emitted to unauthenticated visitors via the `moumprvar` JavaScript object on the Ultimate Member password reset page. An unauthenticated attacker can provide a controlled `username b` parameter to target any WordPress user, regardless of role, without a validated OTP session. This allows the attacker to obtain a password-reset URL in a 302 `Location` header and gain full control of the account. This requires the Ultimate Member Password Reset Form integration to be active and the plugin to not be configured for phone-only reset. **Recommendations** Update the plugin to a version newer than 5.5.1. As a temporary mitigation, disable the Ultimate Member Password Reset Form integration or configure the plugin for phone-only reset.

**Name of the Vulnerable Software and Affected Versions** Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin versions prior to 2.1.1 **Description** An issue exists where the plugin fails to restrict the WordPress role assigned during user creation from public form submissions. When a non-default configuration is active and an integration maps the user role to a public form field, unauthenticated visitors can create an account with administrator privileges. **Recommendations** Update Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin to version 2.1.1 or later.

Name of the Vulnerable Software and Affected Versions The Order Notification for WooCommerce WordPress plugin versions prior to 3.6.3 Description The Order Notification for WooCommerce WordPress plugin before version 3.6.3 bypasses WooCommerce's permission checks, granting full access to all unauthenticated requests. This allows complete read and write access to store resources, including products, coupons, and customer data. Recommendations Update the Order Notification for WooCommerce WordPress plugin to version 3.6.3 or later.

**Name of the Vulnerable Software and Affected Versions** Restaurant Cafeteria WordPress theme versions through 0.4.6 **Description** The WordPress theme allows any logged-in user, including those with subscriber privileges, to perform actions intended for more privileged roles due to missing security checks. Specifically, insecure admin-ajax actions lack nonce and capability verification. This allows an attacker to install and activate plugins from URLs controlled by the attacker, potentially leading to arbitrary PHP code execution. The theme also allows importing demo content that can overwrite site configurations, including pages, menus, and front page settings. **Recommendations** Update Restaurant Cafeteria WordPress theme to a version newer than 0.4.6.

**Name of the Vulnerable Software and Affected Versions** Timetics WordPress plugin versions prior to 1.0.52 **Description** The Timetics WordPress plugin does not have proper authorization checks on a REST endpoint. This allows unauthenticated users to modify a booking's payment status and post status for the 'timetics-booking' custom post type. The vulnerable endpoint allows arbitrary changes to booking information. The vulnerable endpoint is a REST endpoint. The `timetics-booking` custom post type is affected. **Recommendations** Update the Timetics WordPress plugin to version 1.0.52 or later.

**Name of the Vulnerable Software and Affected Versions** Datalogics Ecommerce Delivery WordPress plugin versions prior to 2.6.60 **Description** The Datalogics Ecommerce Delivery WordPress plugin before version 2.6.60 has an unauthenticated REST endpoint that allows remote users to modify the `datalogics token` option without authentication. This token is then used to authenticate requests to a protected endpoint, enabling arbitrary WordPress `update option()` operations. An attacker can leverage this to enable registration and set the default user role to Administrator. The affected plugin exposes an unauthenticated REST endpoint. The vulnerable parameter is `datalogics token`. **Recommendations** Update the Datalogics Ecommerce Delivery WordPress plugin to version 2.6.60 or later.

**Name of the Vulnerable Software and Affected Versions** PowerPack for LearnDash WordPress plugin versions prior to 1.3.0 **Description** The PowerPack for LearnDash WordPress plugin lacks authorization and Cross-Site Request Forgery (CSRF) checks in an AJAX action. This allows unauthenticated users to modify arbitrary WordPress options, such as `default role`, and create new administrator users. **Recommendations** Update the PowerPack for LearnDash WordPress plugin to version 1.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** Login with Salesforce WordPress plugin version 1.0.2 **Description** The Login with Salesforce WordPress plugin does not properly validate user access permissions when logging in through Salesforce. This allows unauthenticated users to authenticate as any user, including administrators, simply by knowing their email address. **Recommendations** Update the Login with Salesforce WordPress plugin to a version beyond 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Prime Listing Manager WordPress plugin versions through 1.1 **Description** The Prime Listing Manager WordPress plugin allows an attacker to gain administrative access without needing an account on the targeted site and perform unauthorized actions. This is due to a hardcoded secret. **Recommendations** Update Prime Listing Manager WordPress plugin to a version newer than 1.1.

**Name of the Vulnerable Software and Affected Versions** Post Slides versions through 1.0.1 **Description** The software does not properly check shortcode attributes before using them to create file paths for inclusion, potentially allowing authenticated users with contributor or higher privileges to carry out Local File Inclusion (LFI) attacks. **Recommendations** Update Post Slides to a version later than 1.0.1.

**Name of the Vulnerable Software and Affected Versions** Bookingor WordPress plugin versions through 1.0.12 **Description** The Bookingor WordPress plugin through version 1.0.12 contains a flaw where authenticated AJAX actions lack proper capability and nonce checks. This allows users with limited privileges to delete Bookingor data. **Recommendations** Update the Bookingor WordPress plugin to a version later than 1.0.12.

**Name of the Vulnerable Software and Affected Versions** The Dreamer Blog WordPress theme versions through 1.2 **Description** The Dreamer Blog WordPress theme is affected by a flaw that allows for arbitrary installations due to the absence of a proper capability check. **Recommendations** Update The Dreamer Blog WordPress theme to a version later than 1.2.

**Name of the Vulnerable Software and Affected Versions** E-xact | Hosted Payment | WordPress plugin versions through 2.0 **Description** The E-xact | Hosted Payment | WordPress plugin through version 2.0 contains a flaw due to inadequate file path validation, allowing unauthenticated attackers to delete arbitrary files on the server. The vulnerability enables file deletion without requiring authentication. **Recommendations** Update E-xact | Hosted Payment | WordPress plugin to a version later than 2.0.

**Name of the Vulnerable Software and Affected Versions** Knowband Mobile App Builder WordPress plugin versions prior to 3.0.0 **Description** The plugin lacks proper authorization checks when deleting users through its REST API. This allows unauthenticated attackers to delete any user. The vulnerable API endpoint allows for arbitrary user deletion without authentication. The affected API endpoint is used for user management. **Recommendations** Update to version 3.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** Pure WC Variation Swatches WordPress plugin versions through 1.1.7 **Description** The Pure WC Variation Swatches WordPress plugin does not perform authorization checks when updating its settings. This allows any authenticated user to modify these settings. **Recommendations** Update the Pure WC Variation Swatches WordPress plugin to a version later than 1.1.7.